[apache/incubator-teaclave] Generating key and signing a file (#554)

[egalijatov1 <no...@github.com.INVALID>]

<!--
  We're glad to anwser any questions related to Teaclave.
  To help people quickly understand the issue, please also
  include some background and context of the question.

  We have documented many useful information on the homepage,
  please check them out first: https://teaclave.apache.org/docs/.
-->

Is it possible to generate a private-public key pair from python (if it does not already exist), and use it to sign data (all from python using teaclave library)? 
Similar to this example from Intel: https://software.intel.com/content/www/us/en/develop/articles/code-sample-gateway-key-provisioning-and-secure-signing-using-intel-software-guard.html

If it is possible, can other processes also access this key and use it for signing or is it tied to the application that generated it? 

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/apache/incubator-teaclave/issues/554

Re: [apache/incubator-teaclave] Generating key and signing a file (#554)

[Mingshen Sun <no...@github.com.INVALID>]

Sorry, I'm not sure if I understand this question correctly. Do you mean signing the _input data_?

Can you give me more context of why "generating a key pair from python and use it to sign data"? Thanks!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/apache/incubator-teaclave/issues/554#issuecomment-923295785

Re: [apache/incubator-teaclave] Generating key and signing a file (#554)

[egalijatov1 <no...@github.com.INVALID>]

I have a python application that generates a pdf report. This report should be signed so that it can't be changed (file can be read and then data can be signed) with a private key stored in SGX. Besides, on the first run, the key pair should be generated. It would also be very useful to restrict other applications and processes from using this key. 
Is this possible using teaclave?
Thank you!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/apache/incubator-teaclave/issues/554#issuecomment-923319766

Re: [apache/incubator-teaclave] Generating key and signing a file (#554)

[egalijatov1 <no...@github.com.INVALID>]

@mssun any info? Thank you in advance!

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/apache/incubator-teaclave/issues/554#issuecomment-931269031

Re: [apache/incubator-teaclave] Generating key and signing a file (#554)

[zf <no...@github.com.INVALID>]

Closed #554 as completed.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/apache/incubator-teaclave/issues/554#event-18694314856
You are receiving this because you are subscribed to this thread.

Message ID: <ap...@github.com>

Re: [apache/incubator-teaclave] Generating key and signing a file (#554)

[Hongbo <no...@github.com.INVALID>]

It seems the whole process is stateful, where "first run" generates a key pair and the key will be used in "following runs". In general, Teaclave cannot handle statefule tasks since FaaS is stateless in nature.

However, specifically in your case, an alternative solution is like this:

1. Prepare a function which outputs a key for signing, and this "key file" will be an encrypted output.
2. Make your Python application accepting an additional input arg, the "key file" generated in step 1. This "key file" can be provided by another party (rather than the user, e.g. service provider), and the Python application sign PDF file with the corresponding key.

If you really want to make it a single function, you can always ask the function to take another input to choose if it's going to generate a key or sign a PDF.

Hope I understand your requirements correctly and hope this can help.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/apache/incubator-teaclave/issues/554#issuecomment-931358162

Re: [apache/incubator-teaclave] Generating key and signing a file (#554)

[zf <no...@github.com.INVALID>]

m4sterchain left a comment (apache/incubator-teaclave#554)

Closed due to inactivity

-- 
Reply to this email directly or view it on GitHub:
https://github.com/apache/incubator-teaclave/issues/554#issuecomment-3087329257
You are receiving this because you are subscribed to this thread.

Message ID: <ap...@github.com>